The ability to conceal the contents of sensitive messages and to verify the contents of messages and the identities of their senders have the potential to be useful in all areas of business

1. Mrs.G.Chandraprabha.,M.Sc.,M.Phil.,
Assistant Professor
Department of Information Technology,
V.V.Vanniaperumal College for Women,
Virudhunagar.

2.  Public-Key Infrastructure (PKI)
 Digital Signatures
 Digital Certificates
 Hybrid Cryptography Systems
 Steganography

3.  The ability to conceal the contents of sensitive messages and to
verify the contents of messages and the identities of their
senders have the potential to be useful in all areas of business
CRYPTOGRAPHIC TOOLS
Public-key Infrastructure (PKI) is an integrated system of software, encryption
methodologies, protocols, legal agreements, and third-party services that enables users
to communicate
securely. PKI systems are based on public-key cryptosystems and include digital
certificates
and certificate authorities (CAs).

4.  Digital certificates are public-key container files that allow computer programs
to validate the key and identify to whom it belongs. (More information about
digital certificates appears in later sections of this chapter.) PKI and the digital
certificate registries they contain enable the protection of information assets by
making verifiable digital certificates readily available to business applications.
Process:
•Authentication
•Integrity
•Privacy
•Authorization
•No reputation

5.  Authentication: Individuals, organizations, and Web servers can validate the
identity of each of the parties in an Internet transaction.
 Integrity: Content signed by the certificate is known to not have been altered
while in transit from host to host or server to client.
 Privacy: Information is protected from being intercepted during transmission.
 Authorization: The validated identity of users and programs can enable
authorization rules that remain in place for the duration of a transaction; this
reduces some of the overhead and allows for more control of access privileges for
specific transactions.
 Nonrepudiation: Customers or partners can be held accountable for transactions,
such as online purchases, which they cannot later dispute

6.  A certificate authority (CA), which issues, manages, authenticates, signs,
and revokes users’ digital certificates, which typically contain the user
name, public key, and other identifying information.
 A registration authority (RA), which operates under the trusted
collaboration of the certificate authority and can handle day-to-day
certification functions, such as verifying registration information,
generating end-user keys, revoking certificates, and validating user
certificate.

7.  Certificate directories, which are central locations for certificate
storage that provide a single access point for administration and
distribution.
 Management protocols, which organize and manage the
communications among Cas Ras, and end users. This includes the
functions and procedures for setting up new users, issuing keys,
recovering keys, updating keys, revoking keys, and enabling the
transfer of certificates and status information among the parties
involved in the PKI’s area of authority.
 Policies and procedures, which assist an organization in the
application and management of certificates, in the formalization of
legal liabilities and limitations, and in actual business use.

8.  Digital signatures were created in response to the rising need to verify
information transferred via electronic systems.
 Asymmetric encryption processes are used to create digital signatures.
 When an asymmetric cryptographic process uses the sender’s private key to
encrypt a message, the sender’s public key must be used to decrypt the
messageWhen the decryption is successful, the process verifies that the message
was sent by the sender and thus cannot be refuted.
 This process is known as nonrepudiation and is the principle of cryptography that
underpins the authentication mechanism collectively known as a digital signature.
Digital signatures are, therefore, encrypted messages that can be mathematically
proven authentic.

9.  The CA application suite issues and uses certificates (keys) that identify and
establish a trust relationship with a CA to determine what additional certificates
(keys) can be authenticated.
 Mail applications use Secure/Multipurpose Internet Mail Extension (S/MIME)
certificates for signing and encrypting e-mail as well as for signing forms.
 Development applications use object-signing certificates to identify signers of
objectoriented code and scripts.
 Web servers and Web application servers use Secure Sockets Layer (SSL)
certificates to authenticate servers via the SSL protocol (which is described
shortly) in order to establish an encrypted SSL session.
 Web clients use client SSL certificates to authenticate users, sign forms, and
participate in single sign-on solutions via SSL

11.  Except in digital certificates, asymmetric key encryption in its pure form is not
widely used, but it is often used in conjunction with symmetric key encryption—
thus, as part of a hybrid encryption system.
 The most common hybrid system is based on the Diffie-Hellman key exchange,
which is a method for exchanging private keys using public key encryption.
 Diffie-Hellman key exchange uses asymmetric encryption to exchange session keys.
 These are limited-use symmetric keys for temporary communications; they allow
two entities to conduct quick, efficient, secure communications based on
symmetric encryption, which is more efficient than asymmetric encryption for
sending messages. Diffie-Hellman provides the foundation for subsequent
developments in public key encryption.

12.  The most popular modern version of steganography involves hiding information
within files that contain digital pictures or other images.
 To understand how this form of steganography works, you must first know a little
about how images are stored
 Most computer graphics standards use a combination of three color values—red,
blue, and green (RGB)—to represent a picture element, or pixel.
 Each of the three color values usually requires an 8-bit code for that color’s
intensity Each color image pixel requires 3 colors 8 bits 24 bits to represent the
color mix and intensity.
 if 1024 horizontal pixels are recorded and 768 vertical pixels are captured, the
image has a 1024 768 resolution and is said to have 786,432 pixels or three-
quarters of a megapixel. Thus, an image that is 1024 768 pixels contains 786,432
groups of 24 bits to represent the red, green, and blue data. The raw image size
can be calculated as 1024 768 24, or 5.66 megabytes

13.  Much of the software currently used to protect the confidentiality
of information are not true cryptosystems.
 Instead, they are applications to which cryptographic protocols have
been added.
 This is perhaps particularly true of Internet protocols; some experts
claim that the Internet and its corresponding protocols were
designed without any consideration for security, which was added
later as an afterthought

14.  S-HTTP (Secure Hypertext Transfer Protocol) and SSL (Secure Sockets Layer) are
two protocols designed to enable secure network communications across the
Internet.
 S-HTTP and SSL ensure Internet security via different mechanisms and can be used
independently or together.
 Netscape developed the Secure Sockets Layer (SSL) protocol to use public key
encryption to secure a channel over the Internet, thus enabling secure
communications. Most popular browsers, including Internet Explorer, use SSL. In
addition to providing data encryption, integrity, and server authentication, SSL
can, when properly configured, provide client authentication
 The SSL Record Protocol is responsible for the fragmentation, compression,
encryption, and attachment of an SSL header to the plaintext prior to
transmission.

15.  Secure HTTP (S-HTTP) is an extended version of Hypertext Transfer Protocol that
provides for the encryption of individual messages transmitted via the Internet
between a client and server.
 S-HTTP is the application of SSL over HTTP, which allows the encryption of all
information passing between two computers through a protected and secure
virtual connection.
 Unlike SSL, in which a secure channel is established for the duration of a session,
S-HTTP is designed for sending individual messages over the Internet and
therefore a session for each individual exchange of data must be established. To
establish a session, the client and server must have compatible cryptosystems
and agree on the configuration

16.  Secure Multipurpose Internet Mail Extensions (S/MIME) builds on the encoding
format of the Multipurpose Internet Mail Extensions (MIME) protocol and uses
digital signature based on public key cryptosystems to secure e-mail. Privacy
Enhanced Mail (PEM) was proposed by the Internet Engineering Task Force
(IETF) and is a standard that uses 3DES symmetric key encryption and RSA for
key exchanges and digital signatures.
 Pretty Good Privacy (PGP) was developed by Phil Zimmermann and uses the
IDEA cipher for message encoding. PGP also uses RSA for symmetric key
exchange and digital signatures.

18.  Just as PGP, PEM, and S/MIME work to secure e-mail operations, a number of related
pro-tocols work to secure Web browsers, especially at electronic commerce sites.
 Secure Electronic Transactions (SET), Secure Sockets Layer (SSL), Secure Hypertext
 Transfer Protocol (S-HTTP), Secure Shell (SSH-2), and IP Security (IPSec). aSecure
Electronic Transactions (SET) was developed by MasterCard and VISA in 1997 to protect
against electronic payment fraud. SET uses DES to encrypt credit card information
transfers and RSA for key exchange

19. Man-in-the-Middle Attack
They attempts to intercept a public key or even to insert a known key structure in place of the
requested public key. Thus, attackers attempt to place themselves between the sender and receiver, and
once they’ve intercepted the request for key exchanges, they send each participant a valid public key,
which is known only to them. To the victims of such attacks, encrypted communication appears to be
occur ring normally, but in fact the attacker is receiving each encrypted message and decoding it (with
the key given to the sending party), and then encrypting and sending it to the intended recipient.
Establishing public keys with digital signatures can prevent the traditional man-in-the-middle attack, as
the attacker cannot duplicate the signatures.
Correlation Attacks
As the complexities of encryption methods have increased, so too have the tools and methods
of cryptanalysts. Correlation attacks are a collection of brute-force methods that attempt to deduce
statistical relationships between the structure of the unknown key and the ciphertext generated by the
cryptosystem. Differential and linear cryptanalysis, which are advance methods of code breaking that are
beyond the scope of this text, have been used to mount successful attacks on block cipher encryptions
such as DES. If these advanced approaches can calculate the value of the public key in a reasonable time,
all messages written with that key can be decrypted. T

20. Dictionary Attacks
In a dictionary attack, the attacker encrypts every word in a
dictionary using the same cryp- tosystem as used by the target in an attempt to
locate a match between the target ciphertext and the list of encrypted words.
Dictionary attacks can be successful when the ciphertext consists of relatively few
characters, as for example files which contain encrypted usernames and passwords.
An attacker who acquires a system password file can run hundreds of thou-sands of
potential passwords from the dictionary he or she has prepared against the stolen
list. Most computer systems use a well-known one-way hash function to store
passwords in such files.